Quick answers
- Is CVE-2026-109340 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-109340 being exploited in the wild.
- How severe is CVE-2026-109340?
- Medium severity, with a CVSS score of 5.4, published 12 October 2026.
- Which products and versions are affected?
- Surrealdb 3.1.0 before 3.3.0.
- Is there a fix for CVE-2026-109340?
- Yes: fixed in 3.3.0. Until then: Restrict vertex DELETE permission on tables that are reference-cascade targets to only principals trusted to delete all connected edge records, or avoid using REFERENCE ON DELETE CASCADE where the referencing record is also a graph-edge endpoint whose edge table relies on PERMISSIONS FOR delete clauses.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-28"}, {"kind": "advisory", "at": "2026-10-12"}, {"kind": "patched", "at": "2026-09-28", "note": "Version 3.3.0 released"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-109340 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-109340?
- Check whether you run Surrealdb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.3.0
Restrict vertex DELETE permission on tables that are reference-cascade targets to only principals trusted to delete all connected edge records, or avoid using REFERENCE ON DELETE CASCADE where the referencing record is also a graph-edge endpoint whose edge table relies on PERMISSIONS FOR delete clauses.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-28"}, {"kind": "advisory", "at": "2026-10-12"}, {"kind": "patched", "at": "2026-09-28", "note": "Version 3.3.0 released"}]
Technical details
The vulnerability is a missing authorization check (CWE-862) in the cascade delete handling of REFERENCE ON DELETE CASCADE operations. When a record is deleted through a cascading reference, the permission context flag disables authorization checks for the cascading delete; this flag incorrectly persists into subsequent edge cleanup operations, bypassing the edge table's PERMISSIONS FOR delete clause. An authenticated attacker with delete permission on a referenced table can exploit this by deleting a record, causing its cascade to delete a graph edge endpoint without permission checks, thus erasing connected edge records despite protective permissions on the edge table.
Affected products
- SurrealDB SurrealDB 3.1.0 before 3.3.0